11–20 of 130 posts
I think he's taking about a solution similar to the RSA key cards typically used for VPN login at some big companies. https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcSP3PxS...
If you look at how they were actually deployed in Europe, you'll realize that it's not much different over there. "Chip and Pin" is if anything worse than no encryption, because it gives the illusion of security. I don't know about the situation in Asia.
Not only should future payment systems be based on cryptography, but they should also require an affirmative step on the part of the payer to initiate a given transaction of a given amount. In other words, it shouldn't be a matter of handing over your card number, or even a one-use cryptographic token, and letting the merchant fill in the details. You should have to explicitly send an amount of money that you specify. Then, of course, a smart merchant would verify that the amount is correct before fulfilling her end of the bargain.
In other words, the process should be that the payer gives money to the payee, not that the payee takes money from the payer.
Unfortunately, as the author points out, progress on this front has been almost nonexistent with respect to the established credit card networks. We may have to hope/work for a totally new system to replace it. (Perhaps Bitcoin, or something inspired by it.)
If you look at how they were actually deployed in Europe, you'll realize that it's not much different over there. "Chip and Pin" is if anything worse than no encryption, because it gives the illusion of security. I don't know about the situation in Asia.
If the the card brand, say Visa, would generate a public key that I could use on my web server to send them their credit card data, then I, my payment gateway, and maybe even my even my merchant bank, would never have to know the card number. VisaNet could decrypt it on their side with their private key and determine the issuer and account information to process it. Just the customer and VisaNet and the issuer probab…
To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…
If you look at how they were actually deployed in Europe, you'll realize that it's not much different over there. "Chip and Pin" is if anything worse than no encryption, because it gives the illusion of security. I don't know about the situation in Asia.
It's far from clear that chip-and-pin has been the unmitigated disaster you imply it to be. You're right that chip-and-pin has problems, but those are design and deployment problems, not problems with PKE in general.
Unfortunately the risk isn't as high as the author intended. There are still many credit card launder groups that take advantage of in-person fake card transactions. The margin is so high that they would often purchase over a few thousand worth of items at Wal-mart or such (mostly gift cards) at a single time and the lack of care from cashiers just doesn't help with the deterrent factor.
Aside from the big boss, even the busboys would try to snatch up items for themselves from the store aside from the gift cards to give back to the big boss. This creates a healthy enough ecosystem that each part of the chain will have enough motivation to not cause the group to fall apart, because the margin is just too high.
The credit card itself builds too much on trust and is fundamentally broken. Trust is a rare quality in human and it is just not present in a criminal's eyes. Of course, the trust allows a credit card to be used simply without much additional overhead. If one day we collectively deem credit cards to be insecure enough maybe we'll consider trading off the easy usability for a more secure measure such as presenting your id when using credit card. Or perhaps we should all just wait for the future where we each have biometric chips embedded in us to scan at a credit card machine.
There is no solution for credit card fraud because the credit card companies do not pay the bulk of the fraud that happens. I have been the subject of fraud both as a merchant and as a consumer and in both cases i was the one that paid.